#Beautune patch register code
#Beautune patch register series

The Biden administration announced plans this week to introduce a US Cyber Trust Mark for smart devices – think Energy Star, but for internet-connected devices. 'We will continue to invent more privacy features on behalf of our customers and ensure they are aware of the controls and options available to them,' Amazon said, as ordered.Ĭyber security labels coming soon to US smart tech Writing on the same day the accusations came to light, Amazon said it disagreed with the FTC's claims, but was still settling to put the matter behind it. The suit, which was brought in late May, extracted a bargain from Amazon as soon as it was filed. Along with the pittance of a fine, Amazon has agreed to delete inactive child profiles, stop misrepresenting its Alexa recording retention policy and to report to the DoJ on its compliance with the orders for the next decade. The settlement stems from charges that Amazon had a policy of retaining voice recordings of those under the age of 13 indefinitely by default – which violates COPPA rules – among other privacy violations.Īmazon agreed to pay the DoJ $25 million, or 0.78 percent of its Q1 2023 profit, to settle the issue without admitting or denying responsibility. The US Department of Justice said this week that it had reached an agreement with Amazon regarding its alleged violations of the Children's Online Privacy Protection Act (COPPA).

#Beautune patch register series

CVSS 8.8 – CVE-2023-36884: Microsoft said it's investigating a series of RCE vulnerabilities in Office and Windows products that are under active exploit via malicious Office documents.Īmazon agrees to pay $25 million to settle Alexa COPPA violations.

#Beautune patch register code

CVSS 9.8 – CVE-2023-3519: Attackers are actively exploiting a remote code execution vulnerability in Citrix Gateway and ADC identified by the company and patched on July 18.

Just a pair of new known exploited vulnerabilities this week, but they're quite high profile:

CVSS 8.1 – Multiple CVEs: KingHistorian time-series databases made by WellinTech contain a pair of vulnerabilities that an attacker could use to send malicious data and disclose sensitive info.Īlso, both Oracle and Atlassian released monthly patches this week to address several critical issues.

CVSS 9.8 – CVE-2023-3638: The GV-ADR2701 model of GeoVision security cameras has an issue on the login page that an attacker could exploit by editing the login response to gain access to the camera's web app.

CVSS 10.0 – Multiple CVEs: Iagona's ScrutisWeb software, used for monitoring fleets of ATMs, contains multiple vulnerabilities that could allow an attacker to upload and execute arbitrary files.

Unfortunately, the patch deployed in July 11 was incomplete and allowed it to be chained with the exploit patched on July 14, so a third patch has been issued. PD actually found a new vulnerability necessitating another patch on July 14. It breaks down like this: Researchers from Project Discovery published an exploit for what Rapid7 said PD likely thought was for a deserialization of untrusted data exploit in ColdFusion patched by Adobe on July 11. With the assistance of Rapid7 security researchers, Adobe determined it issued an incomplete fix for an access control bypass in ColdFusion that, when chained with a subsequent vulnerability, led to active exploitation. Adobe leads the critical vulnerability pack this week with a series of security stumbles.